mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 02:26:12 +02:00
Devin FoleyandPaperclip
00ae558b25
The Run security gates step was hitting the job-level 5-minute timeout (timeout-minutes: 5) and cancelling the entire 'review' check, even when the script's documented contract is 'always exit 0 — silent and informational'. continue-on-error: true on a step suppresses step failures but does NOT override a job-level timeout. The script could hang in any unbounded API call (security-advisories list pagination, the advisory POST/PATCH, etc.) and take down the whole job. Four layered defences so any single failure mode is contained: - ghFetch: per-call AbortController timeout (default 15s) so no single GitHub API call can eat the workflow budget. - check-pr-security: 90s wall-clock watchdog that exits 0 regardless of what the rest of the script is doing, matching the always-exit-0 contract. - findExistingDraftAdvisory: 20-page pagination cap with console.warn, falling through to create a fresh draft instead of looping forever. - commitperclip-review.yml: timeout-minutes: 3 on the security step (combined with continue-on-error: true so the job stays green if it ever fires). Co-Authored-By: Paperclip <noreply@paperclip.ing>